LLMHigh
CVE-2026-41523: vLLM is an inference and serving engine for large language models (LLMs). Prior to 0.22.0, an assert…
- Occurred
- Jun 22, 2026
- Published
- Jun 22, 2026
- Source
- NVD CVE
Summary
vLLM is an inference and serving engine for large language models (LLMs). Prior to 0.22.0, an assert-based security check in vLLM's activation function loading allows any unauthenticated attacker to achieve arbitrary code execution on the server by publishing a malicious HuggingFace model, when vLLM runs in Python optimized mode (python -O or PYTHONOPTIMIZE=1). This vulnerability is fixed in 0.22.0.
Tags
- CVE
- CVE-2026-41523
- cvss:HIGH
Classification
Category confidence: 95%
Severity confidence: 90%
Rationale: vLLM LLM serving engine vulnerability allows arbitrary code execution via malicious model upload.
Classifier: Qwen/Qwen3.5-35B-A3B-FP8